Usage

When you run tcpextract, by default, it will listen on any avaible interface and will put extracted files in ‘./output’.
Please remember that capturing live streams will require root privileges.
Live sniffing is really slow. If you can, use tcpdump or something else to capture data.

If you want further information on how to change default behavior please run:

$ tcpextract --help

Extending

tcpextract is modular, so it is easy to extend.

If you are looking for further information about writing modules to support more protocols please read the Wiki